CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- singularIn Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows...7.8 High
- samba, fedoraproject fedora +1 moreIn Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.5.5 Medium
- nodebbAccount takeover via cryptographically weak PRNG in NodeBB Forum9.0 Critical
- apache openofficeApache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password8.8 High
- quest kace systems management applianceIn Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation...7.5 High
- open-xchange ox app suiteOX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable,...6.5 Medium
- otp-generator project otp-generatorInsecure Randomness6.5 Medium
- libreoffice, debian linux +1 moreExecution of Untrusted Macros Due to Improper Certificate Validation7.5 High
- packback lti 1.3 tool library, packbackbooks lti-1-3-php-library +1 moreUse of a Broken or Risky Cryptographic Algorithm in packbackbooks/lti-1-3-php-library7.5 High
- siemens scalance x200-4p irt, scalance x201-3p irt, scalance x201-3p irt pro +55 more +57 moreA vulnerability has been identified in SCALANCE X200-4P IRT (All versions), SCALANCE X200-4P IRT ...8.8 High
- dell bsafe crypto-c micro edition, bsafe crypto-c-micro-edition, bsafe micro-edition-suite +4 more +6 moreDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, ...5.3 Medium
- samsung find my mobile, samsung mobile findmymobile +1 moreImproper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker...5.3 Medium
- control-webpanel webpanelThe password reset token in CWP v0.9.8.1126 is generated using known or predictable values.5.9 Medium
- yokogawa aw810d firmware, yokogawa electric corporation communication module for wide area communication router (for aw810d) vi461 +1 moreUse of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of...7.5 High
- vitalpbxMissing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to...4.9 Medium
- totd project totdtotd before 1.5.3 does not properly randomize mesg IDs.6.5 Medium
- argoproj argo-cd, argo cd +1 moreInsecure entropy in argo-cd8.3 High
- zte mf297d firmwareZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values...7.5 High
- go standard library crypto/tls, golang go +1 moreSession tickets lack random ticket_age_add in crypto/tls3.1 Low
- linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreThe Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source...3.3 Low
- ssh.net project ssh.netWeak private key generation in SSH.NET6.5 Medium
- random password generator project password generatorInsecure PRNG use in random_password_generator7.5 High
- openmoney api project apiOpenmoney API through 2020-06-29 uses the JavaScript Math.random function, which does not provide...7.5 High
- jetbrains ktorSHA1 implementation in JetBrains Ktor Native before 2.0.1 was returning the same value8.7 High
- uclibc, uclibc-ng project uclibc-ng +1 moreuClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may...6.5 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +9 more +11 moreOn F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x...7.4 High
- pingidentity pingid, pingid windows login, ping identity pingid mobile application +2 morePingID iOS mobile application prior to 1.19 vulnerable to pre-computed dictionary attacks6.6 Medium
- pingidentity pingid, pingid windows login, ping identity pingid mobile application +2 morePingID Android mobile application prior to 1.19 vulnerable to pre-computed dictionary attacks6.6 Medium
- swift sensors gateway, swiftsensors sg3-1010 firmware +1 moreAn authentication bypass vulnerability exists in the device password generation functionality of...10.0 Critical
- siemens scalance x302-7 eec (230v), scalance x302-7 eec (230v, coated), scalance x302-7 eec (24v) +72 more +74 moreA vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V,...9.8 Critical
- sick ag msc800, sick msc800 firmware +1 moreThe vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the...9.1 Critical
- jetbrains ktorIn JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't...3.3 Low
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, 8.2.2-9.3.x, contains a predictable file name from observable state...9.1 Critical
- codesys control for beaglebone sl, control for beckhoff cx9020 sl, control for empc-a/imx6 sl +28 more +30 moreCommunication Components in multiple CODESYS products vulnerable to communication channel disruption7.5 High
- scala-js scala.jsrandomUUID in Scala.js before 1.10.0 generates predictable values.7.5 High
- totolink a3100r firmwareTotolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web...8.8 High
- rambus safezone basic crypto module, canon imageprograf firmware, imagerunner firmware +89 more +91 moreThe Rambus SafeZone Basic Crypto Module, as used in certain Fujifilm (formerly Fuji Xerox)...9.1 Critical
- mendix, siemens mendix applications using mendix 7 +1 moreA vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23...6.5 Medium
- cyberark identityCyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource,...5.3 Medium
github.com/coredns/corednsGoImproper random number generation in github.com/coredns/corednsNo score- fortinet fortimailAn improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to...9.8 Critical
- tp-link tl-wa850re firmwareTP-Link TL-WA850RE Wi-Fi Range Extender before v6_200923 was discovered to use highly predictable...9.8 Critical
- valmet dnaRemote code execution in Valmet DNA before Collection 20218.8 High
- dell emc unity operating environment, vnx control station +1 moreDell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass...9.8 Critical
- wolfsslwolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects...9.1 Critical
- apache kylinHardcoded credentials7.5 High
- nicu micle simple jwt login, simple jwt login project jwt login +1 moreSimple JWT Login < 3.3.0 - Insecure Password Creation7.5 High
- netbsdIn NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic...7.5 High
- netbsdIn NetBSD through 9.2, there is an information leak in the TCP ISN (ISS) generation algorithm.7.5 High
- reprisesoftware reprise license managerAn issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can...7.5 High
- Show moreLoading…